I just want to pose a quick question about the Microsoft API URLs that are used in the add-on.  At what point will the add-on be updated to reflect the new URL changes?  I had a conversation with a Microsoft engineer, and he mentioned that the following URLs may not work past Dec 31 2024:    API_ADVANCED_HUNTING = "/api/advancedhunting/run" API_ALERTS = "/api/alerts" API_INCIDENTS = "/api/incidents This link shows the difference between some of the old vs new urls :  Use the Microsoft Graph security API - Microsoft Graph v1.0 | Microsoft Learn I know it's a while off.  However, it comes quick at times.  Just trying to understand the process so I can stay ahead of it.  Also, I have seen add-ons that have the option for legacy inputs and also for current.  It would be great to have an option like that before the URL switch for this add-on. ... View more

For the two indexes.conf volume settings below - would one take precedence over the other if they use the same path? [volume:hotwarm] path = /splunk-data/hot-warm # ~5.8 TB maxVolumeDataSizeMB = 5800000 [volume:_splunk_summaries] path = /splunk-data/hot-warm # ~ 100GB maxVolumeDataSizeMB = 100000 I am observing that the volume setting with the lower value appears to be taking precidence over the volume with the higher value. Every index that is configured to use the "hotwarm" volume looks to be getting capped at 100GB when looking at my MC.(indexing -> indexes and volumes -> volume detail:instance) Below is the sample data I see within the MC for one indexer for hotwarm. Volume Usage Volume       Volume Usage (GB)    Volume Capacity (GB)    Volume Path hotwarm            948.96                            5664.06                        /splunk-data/hot-warm Index Directories Using This Volume Index:Directory                         Disk Usage (GB)        Data Age (Days) paloalto:home                             95.53                                   11 asa:home                                       91.57                                  15 wsa:home                                      87.06                                   96 extrahop:home                            86.46                                 157 firepower:home                           85.50                                 188 adaudit:home                               80.08                                  539 phantom_container:home     78.44                                   497 sep:home                                       75.07                                   394 waf:home                                       64.47                                  489 For the sample above, the volume usage for hotwarm never goes past 1TB so it leads me to believe the lower setting does take precedence because the individual indexes don't go past 100GB each. After a ton of digging (btool, SPL, linux commands, etc...) the same setting keeps on showing up as the possible culprit (maxVolumeDataSizeMB = 100000). If this behavior happens to be true then I assume I'd need to create another volume for my summaries? If not true then I am truly stumped as I see no other comparable setting anywhere within the system that would cause the limitation. By the way, the indexers are clustered (10) with SF=2 RF=3 on Red Hat 7.3 and using Splunk 7.3.1. Also, I saw that this type of configuration was shown in the 7.3.1 admin manual as an example (https://docs.splunk.com/Documentation/Splunk/7.3.1/Admin/Indexesconf). It leads me to believe it is possible to have a configuration that can share volumes. Example subset from Admin Manual below (using the same path): ### Indexes may be allocated space in effective groups by sharing volumes ### # perhaps we only want to keep 100GB of summary data and other # low-volume information [volume:small_indexes] path = /mnt/splunk_indexes maxVolumeDataSizeMB = 100000 # and this is our main event series, allowing 50 terabytes [volume:large_indexes] path = /mnt/splunk_indexes maxVolumeDataSizeMB = 50000000 ... View more

Hello, Has anyone seen events like this before? (looking at index=_internal): WARN CMSlave - event=populateSummaryInfo got unknown_state summary=/splunk-data/hot-warm/sep/datamodel_summary/152_4A0854A5-EE41-403E-8D6C-C8A7ED6FE0BA/0D23E24D-41E9-464F-9AC4-72E9B27741C3/DM_Splunk_SA_CIM_Network_Traffic WARN CMSlave - event=populateSummaryInfo got unknown_state summary=/splunk-data/hot-warm/paloalto/datamodel_summary/763_5E0FBB73-C7A1-4769-960C-315973743080/0D23E24D-41E9-464F-9AC4-72E9B27741C3/DM_Splunk_SA_CIM_Network_Traffic Would anyone know what they mean? I have looked everywhere for an answer, but i have not found it yet. Not sure what relevant info to include — so here is my stab at it: There are 10 indexers in this setup (clustered) and every indexer is exhibiting similar events. -I do not know when this first happened — I just noticed it. -I have a search head for (ES) that has the data models restricted to specific indexes and tags — all accelerated models are at 100% completed with the exception of Network Traffic. Network traffic is at 87% and building very slowly. Not sure if I should rebuild or wait. -I doubt it's a permissions issue since Splunk is able to write indexed data to the directory (/splunk-data/hot-warm). Splunk version is 7.1.3 on RedHat Linux v7.3 & v7.4 64bit. From my management console I see the directory is not full (/splunk-data/hot-warm)(only using ~ 625gb of ~6tb). Thanks, Daniel Forester ... View more